CVE-2026-92715: Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitizearray() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wpinsertpost() argument array as an update to the existing post rather than a new insert.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with Author-level access or higher. They can target courses created by other instructors.
What can a successful attacker change?
They can modify another instructor’s course title, content, and status, and can reassign ownership of that course to themselves.
Are installations running version 4.1.0 affected?
Yes. The issue affects all Tutor LMS versions up to and including 4.1.0.
How does the attacker trigger the unauthorized course update?
The attacker supplies an existing course ID through the user-controlled POST ID parameter. That ID is retained in the arguments passed to WordPress, causing wp_insert_post() to update the referenced course rather than create a new one.